CVE-2017-14867

Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support.

• CWE-78

• http://www.openwall.com/lists/oss-security/2017/09/26/9Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/101060Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039431Third Party Advisory, VDB Entry
• https://bugs.debian.org/876854Issue Tracking, Mailing List, Third Party Advisory
• https://lists.debian.org/debian-security-announce/2017/msg00246.htmlMailing List, Third Party Advisory
• https://public-inbox.org/git/xmqqy3p29ekj.fsf%40gitster.mtv.corp.google.com/T/#u
• https://www.debian.org/security/2017/dsa-3984Third Party Advisory
• http://www.openwall.com/lists/oss-security/2017/09/26/9Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/101060Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039431Third Party Advisory, VDB Entry
• https://bugs.debian.org/876854Issue Tracking, Mailing List, Third Party Advisory
• https://lists.debian.org/debian-security-announce/2017/msg00246.htmlMailing List, Third Party Advisory
• https://public-inbox.org/git/xmqqy3p29ekj.fsf%40gitster.mtv.corp.google.com/T/#u
• https://www.debian.org/security/2017/dsa-3984Third Party Advisory

Published

Sep 29, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14861There is a stack consumption vulnerability in the Exiv2::Int…
• CVE-2017-14862An Invalid memory address dereference was discovered in Exiv…5.5
• CVE-2017-14863A NULL pointer dereference was discovered in Exiv2::Image::p…
• CVE-2017-14864An Invalid memory address dereference was discovered in Exiv…5.5
• CVE-2017-14865There is a heap-based buffer overflow in the Exiv2::us2Data …
• CVE-2017-14866There is a heap-based buffer overflow in the Exiv2::s2Data f…
• CVE-2017-14868Restlet Framework before 2.3.11, when using SimpleXMLProvide…
• CVE-2017-14869In Android for MSM, Firefox OS for MSM, QRD Android, with al…
• CVE-2017-1487IBM Sterling File Gateway 2.2 could allow an authenticated a…
• CVE-2017-14870In Android for MSM, Firefox OS for MSM, QRD Android, with al…
• CVE-2017-14872While flashing a meta image, a buffer over-read can potentia…
• CVE-2017-14873In Android for MSM, Firefox OS for MSM, QRD Android, with al…